WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
4.3
CVE-2026-4123
Sep 21, 2026
Researcher: Nabil Irawan
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
4.3
CVE-2026-12995
Sep 21, 2026
Researcher: Dmitrii Ignatyev
Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-84150
Sep 21, 2026
Researcher: Revanth Hari Narayana Matte
WC Fields Factory <= 4.1.10 - Missing Authorization
4.3
CVE-2026-93508
Sep 21, 2026
Researcher: Farid Narimanov
MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-81339
Sep 21, 2026
Researcher: Revanth Hari Narayana Matte
Real3D Flipbook Lite <= 5.3 - Missing Authorization
4.3
CVE-2026-86842
Sep 21, 2026
Researcher: Artus KG
Zportals <= 6.4.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-18365
Sep 21, 2026
Researcher: Erwan LR
Directorist 3.1.0 - 8.9.4 - Missing Authorization
4.3
CVE-2026-84098
Sep 21, 2026
Researcher: Artus KG
Recipe Maker <= 10.8.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-86603
Sep 21, 2026
Researcher: Abdullah Kareem
Points and Rewards for WooCommerce <= 2.10.3 - Missing Authorization
4.3
CVE-2026-93510
Sep 21, 2026
Researcher: Farid Narimanov
Forminator Forms <= 1.57.2.0 - Missing Authorization
4.3
CVE-2026-87069
Sep 21, 2026
Researcher: Karthik Ramakrishnan
Paymob for WooCommerce <= 4.1.13 - Missing Authorization
4.3
CVE-2026-87981
Sep 21, 2026
Researcher: Ryan Fabella
Zportals <= 6.4.1 - Missing Authorization
4.3
CVE-2026-18364
Sep 21, 2026
Researcher: Erwan LR
Recipe Maker 10.3.0 - 10.8.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-86602
Sep 21, 2026
Researcher: Abdullah Kareem
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Missing Authorization
4.3
CVE-2026-91077
Sep 21, 2026
Researcher: Artus KG
Booking Manager <= 2.1.20 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-91025
Sep 21, 2026
Researcher: Choriyev Qahramon
WC Fields Factory <= 4.1.10 - Missing Authorization
4.3
CVE-2026-93507
Sep 21, 2026
Researcher: Farid Narimanov
Directorist 8.9.1 - 8.9.4 - Missing Authorization
4.3
CVE-2026-84027
Sep 21, 2026
Researcher: LevinityCyber
The Events Calendar 6.15.0 - 6.17.4.1 - Missing Authorization
4.3
CVE-2026-84742
Sep 21, 2026
Researcher: Jashid Sany
The Events Calendar 6.15.16.1 - 6.17.4.1 - Missing Authorization
4.3
CVE-2026-84743
Sep 21, 2026
Researcher: Mohammed Abd Alrahman
Title CVE ID CVSS Researchers Date
RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action CVE-2026-4123 4.3 Nabil Irawan September 21, 2026
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter CVE-2026-12995 4.3 Dmitrii Ignatyev September 21, 2026
Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2026-84150 4.3 Revanth Hari Narayana Matte September 21, 2026
WC Fields Factory <= 4.1.10 - Missing Authorization CVE-2026-93508 4.3 Farid Narimanov September 21, 2026
MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2026-81339 4.3 Revanth Hari Narayana Matte September 21, 2026
Real3D Flipbook Lite <= 5.3 - Missing Authorization CVE-2026-86842 4.3 Artus KG September 21, 2026
Zportals <= 6.4.1 - Authenticated (Subscriber+) Information Exposure CVE-2026-18365 4.3 Erwan LR September 21, 2026
Directorist 3.1.0 - 8.9.4 - Missing Authorization CVE-2026-84098 4.3 Artus KG September 21, 2026
Recipe Maker <= 10.8.1 - Authenticated (Subscriber+) Information Exposure CVE-2026-86603 4.3 Abdullah Kareem September 21, 2026
Points and Rewards for WooCommerce <= 2.10.3 - Missing Authorization CVE-2026-93510 4.3 Farid Narimanov September 21, 2026
Forminator Forms <= 1.57.2.0 - Missing Authorization CVE-2026-87069 4.3 Karthik Ramakrishnan September 21, 2026
Paymob for WooCommerce <= 4.1.13 - Missing Authorization CVE-2026-87981 4.3 Ryan Fabella September 21, 2026
Zportals <= 6.4.1 - Missing Authorization CVE-2026-18364 4.3 Erwan LR September 21, 2026
Recipe Maker 10.3.0 - 10.8.1 - Authenticated (Subscriber+) Information Exposure CVE-2026-86602 4.3 Abdullah Kareem September 21, 2026
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Missing Authorization CVE-2026-91077 4.3 Artus KG September 21, 2026
Booking Manager <= 2.1.20 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2026-91025 4.3 Choriyev Qahramon September 21, 2026
WC Fields Factory <= 4.1.10 - Missing Authorization CVE-2026-93507 4.3 Farid Narimanov September 21, 2026
Directorist 8.9.1 - 8.9.4 - Missing Authorization CVE-2026-84027 4.3 LevinityCyber September 21, 2026
The Events Calendar 6.15.0 - 6.17.4.1 - Missing Authorization CVE-2026-84742 4.3 Jashid Sany September 21, 2026
The Events Calendar 6.15.16.1 - 6.17.4.1 - Missing Authorization CVE-2026-84743 4.3 Mohammed Abd Alrahman September 21, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 10, 2026
Vulns
1 Ananda Dhakal 171
2 Wordfence PRISM 68
3 Intrudify 46
4 Artus KG 36
5 Karthik Ramakrishnan 34
6 Jakub Herman 33
7 nh4tvd 32
8 Rafie Muhammad 19
9 daroo 19
10 Francisco José Ramírez Vicente 18
11 JunHee CHO 18
12 Pablo González Pérez 18
13 Iñigo Sánchez Enciso 18
14 neurotx 18
15 Erwan LR 18
16 Peter Tang 16
17 Supakiad S. (m3ez) 16
18 Naoki Kawahigashi 15
19 vuxvinh 15
20 Kuba 15

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation